rule APT_Gelsemium_Gelsevirine_June_2021_1 {
   meta:
        description = "Detect Gelsevirine malware (Main Plug-in)"
        author = "Arkbird_SOLG"
        reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
        date = "2021-06-12"
        hash1 = "1a9d78e5c255de239fb18b2cf47c4c2298f047073299c27fb54a0edf08a1d5a1"
        hash1 = "51b9296ff1f562350cd63abd22c6032ef26d5ae6a3e2e5e0f851d8b1a5d0ee35"
        tlp = "white"
        adversary = "Gelsemium"
   strings:      
            $s1 = { 48 8b c4 55 41 56 41 57 48 8d a8 38 fa ff ff 48 81 ec b0 06 00 00 48 c7 85 a0 02 00 00 fe ff ff ff 48 89 58 08 48 89 70 10 48 89 78 18 4c 89 60 20 48 8b 05 68 bf 0b 00 48 33 c4 48 89 85 a0 05 00 00 45 33 e4 4c 89 65 08 4c 89 65 10 44 89 64 24 20 48 8d 54 24 20 48 8d 4d 08 e8 30 96 01 00 90 48 c7 85 f8 00 00 00 07 00 00 00 4c 89 a5 f0 00 00 00 66 44 89 a5 e0 00 00 00 45 8d 44 24 04 48 8d 15 79 d8 08 00 48 8d 8d e0 00 00 00 e8 dd b0 00 00 90 48 8d 8d e0 00 00 00 e8 50 30 ff ff 90 48 83 bd f8 00 00 00 08 72 0d 48 8b 8d e0 00 00 00 ff 15 b0 32 06 00 48 c7 85 b8 01 00 00 07 00 00 00 4c 89 a5 b0 01 00 00 66 44 89 a5 a0 01 00 00 41 b8 10 00 00 00 48 8d 15 61 d6 08 00 48 8d 8d a0 01 00 00 e8 85 b0 00 00 90 48 8d 95 a0 01 00 00 48 8d 8d 80 05 00 00 e8 41 96 01 00 90 48 83 bd b8 01 00 00 08 72 0d 48 8b 8d a0 01 00 00 ff 15 51 32 06 00 48 c7 85 68 04 00 00 07 00 00 00 4c 89 a5 60 04 00 00 66 44 89 a5 50 04 00 00 48 c7 85 78 01 00 00 07 00 00 00 4c 89 a5 70 01 00 00 66 44 89 a5 60 01 00 00 49 83 ce ff 4d 8b ce 45 33 c0 48 8d 95 80 05 00 00 48 8d 8d 60 01 00 00 e8 c8 ae 00 00 90 48 8d 95 60 01 00 00 48 8d 8d e0 01 00 00 e8 e4 5b ff ff 90 48 8d 8d 50 04 00 00 48 3b c8 74 15 4d 8b ce 45 33 c0 48 8b d0 48 8d 8d 50 04 00 00 e8 92 ae 00 00 48 8d 8d 50 04 00 00 e8 b6 11 ff ff 90 48 83 bd f8 01 00 00 08 72 0d 48 8b 8d e0 01 00 00 ff 15 a6 31 06 00 48 c7 85 f8 01 00 00 07 00 00 00 4c 89 a5 f0 01 00 00 66 44 89 a5 e0 01 00 00 48 83 bd 78 01 00 00 08 72 0d 48 8b 8d 60 01 00 00 ff 15 75 31 06 00 33 d2 48 8d 8d 50 04 00 00 e8 5f 2b 04 00 48 c7 85 58 01 00 00 07 00 00 00 4c 89 a5 50 01 00 00 66 44 89 a5 40 01 00 00 41 b8 0d 00 00 00 48 8d 15 b8 e2 08 00 48 8d 8d 40 01 00 00 e8 3c af 00 00 90 e8 96 2d ff ff 48 8d 48 30 48 8d 95 40 01 00 00 e8 b6 77 00 00 48 8b c8 e8 fe dc 02 00 48 8b c8 e8 16 d5 ff ff 90 48 83 bd 58 01 00 00 08 72 0d 48 8b 8d 40 01 00 00 ff 15 f6 30 06 00 48 c7 85 18 01 00 00 07 00 00 00 4c 89 a5 10 01 00 00 66 44 89 a5 00 01 00 00 41 b8 24 00 00 00 48 8d 15 d7 e3 08 00 48 8d 8d 00 01 00 00 e8 cb ae 00 00 90 48 8d 8d 00 01 00 00 e8 ce 6b 00 00 84 c0 0f 94 c3 48 83 bd 18 01 00 00 08 72 0d 48 8b 8d 00 01 00 00 ff 15 9a 30 06 00 84 db 0f 84 36 08 00 00 4c 89 a5 88 04 00 00 4c 89 a5 90 04 00 00 e8 f7 3b 01 00 48 89 85 88 04 00 00 48 c7 45 50 07 00 00 00 4c 89 65 48 66 44 89 65 38 41 b8 0b 00 00 00 48 8d 15 2a d6 08 00 48 8d 4d 38 e8 59 ae 00 00 90 e8 b3 2c ff ff 48 8d 48 30 48 8d 55 38 e8 96 75 00 00 48 c7 85 b0 04 00 00 07 00 00 00 4c 89 a5 a8 04 00 00 66 44 89 a5 98 04 00 00 4d 8b ce 45 33 c0 48 8b d0 48 8d 8d 98 04 00 00 e8 d7 ac 00 00 90 48 83 7d 50 08 72 0a 48 8b 4d 38 ff 15 fd 2f 06 00 48 c7 45 50 07 00 00 00 4c 89 65 48 66 44 89 65 38 4c 89 a5 b8 04 00 00 4c 89 a5 c0 04 00 00 4c 89 a5 c8 04 00 00 48 c7 45 00 07 00 00 00 4c 89 65 f8 66 44 89 65 e8 41 b8 01 00 00 00 48 8d 15 0d e3 08 00 48 8d 4d e8 e8 b8 ad 00 00 90 48 c7 45 c0 07 00 00 00 4c 89 65 b8 66 44 89 65 a8 41 b8 0d 00 00 00 48 8d 15 e9 e2 08 00 48 8d 4d a8 e8 90 ad 00 00 90 e8 ea 2b ff ff 48 8d 48 30 48 8d 55 a8 e8 cd 74 00 00 48 8b d0 4c 8d 45 e8 48 8d 8d b8 04 00 00 e8 1a 55 01 00 90 48 83 7d c0 08 72 0a 48 8b 4d a8 ff 15 50 2f 06 00 48 c7 45 c0 07 00 00 00 4c 89 65 b8 66 44 89 65 a8 48 83 7d 00 08 72 0a 48 8b 4d e8 ff 15 2e 2f 06 00 48 c7 45 00 07 00 00 00 4c 89 65 f8 66 44 89 65 e8 48 8d 85 98 04 00 00 48 89 85 c0 00 00 00 48 8d 85 88 04 00 00 48 89 85 c8 00 00 00 48 8b 9d b8 04 00 00 48 8b bd c0 04 00 00 48 3b df 0f 84 8b 02 00 00 66 90 4c 89 a5 48 05 00 00 4c 89 a5 50 05 00 00 48 c7 45 30 07 00 00 00 4c 89 65 28 66 44 89 65 18 4c 8d 85 50 04 00 00 48 83 bd 68 04 00 00 08 4c 0f 43 85 50 04 00 00 48 8d 95 50 04 00 00 48 0f 43 95 50 04 00 00 48 8b 85 60 04 00 00 4d 8d 04 40 48 8d 4d 18 e8 37 b4 01 00 90 48 8d 55 18 48 8d 8d 48 05 00 00 e8 36 9a 00 00 90 48 83 7d 30 }
            $s2 = { 48 c7 85 b0 04 00 00 07 00 00 00 4c 89 a5 a8 04 00 00 66 44 89 a5 98 04 00 00 4c 8b 85 88 04 00 00 4d 8b c8 4d 8b 00 48 8d 95 28 02 00 00 48 8d 8d 88 04 00 00 e8 d1 fe 00 00 48 8b 8d 88 04 00 00 ff 15 5c 28 06 00 48 c7 45 e0 0f 00 00 00 4c 89 65 d8 c6 45 c8 00 41 b8 0e 00 00 00 48 8d 15 b7 db 08 00 48 8d 4d c8 e8 ee d0 00 00 90 48 8d 4d c8 e8 54 8c 01 00 48 8b d8 48 83 7d e0 10 72 0a 48 8b 4d c8 ff 15 18 28 06 00 48 c7 45 e0 0f 00 00 00 4c 89 65 d8 c6 45 c8 00 48 }
            $s3 = { 48 8d 8d a8 02 00 00 e8 88 64 01 00 90 48 8b 08 48 89 4c 24 38 48 8b 48 08 48 89 4c 24 40 4c 89 20 4c 89 60 08 48 8d 54 24 38 48 8d 4c 24 48 e8 a0 8e 01 00 90 48 c7 45 a0 07 00 00 00 4c 89 65 98 66 44 89 65 88 41 b8 0b 00 00 00 48 8d 15 d9 d3 08 00 48 8d 4d 88 e8 a8 a5 00 00 90 48 8d 54 24 48 48 8d 4d 88 e8 d9 60 00 00 90 48 83 7d a0 08 72 0a 48 8b 4d 88 ff 15 7f 27 06 00 48 c7 45 a0 07 00 00 00 4c 89 65 98 66 44 89 65 88 48 8b 4c 24 48 48 85 c9 74 0b 48 8b 01 ba 01 00 00 00 ff 10 90 48 8b 4c 24 40 }
            $s4 = { 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 85 df 06 00 49 8b ce e8 05 dd ff ff e8 e0 db ff ff 48 8d 78 30 e8 27 fc ff ff 33 f6 84 c0 0f 85 ae 01 00 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 44 8d 46 07 48 8d 15 cf 84 09 00 48 8d 4c 24 20 e8 45 5d 01 00 90 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 44 8d 46 07 48 8d 15 a6 84 09 00 48 8d 4c 24 40 e8 1c 5d 01 00 90 48 8d 54 24 20 48 8b cf e8 5e 24 01 00 48 8b d8 48 8d 54 24 40 48 8d 4d 18 e8 4d 24 01 00 48 8b c8 48 8b d3 e8 72 c1 ff ff 85 c0 0f 9e c3 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 d2 de 06 00 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 48 83 7c 24 38 08 72 0b 48 8b 4c 24 20 ff 15 ac de 06 00 84 db 0f 84 ed 00 00 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 20 00 00 00 48 8d 15 ec 84 09 00 48 8d 4c 24 20 e8 82 5c 01 00 90 48 8d 05 3a aa 09 00 48 89 44 24 40 48 c7 44 24 60 07 00 00 00 48 89 74 24 58 66 89 74 24 48 49 83 c9 ff 45 33 c0 48 8d 54 24 20 48 8d 4c 24 48 e8 0c 5b 01 00 90 48 8d 05 e4 a8 09 00 48 89 45 80 48 8d 4d 88 ff 15 76 de 06 00 48 8d 05 ff e7 06 00 48 89 45 a0 48 89 75 a8 48 89 75 b0 48 89 75 b8 c7 45 c0 ff ff ff ff 48 8b 45 80 48 63 48 04 48 8d 05 71 9a 09 00 48 89 44 0d 80 48 8b 45 80 48 63 48 08 48 8d 05 bd ac 09 00 48 89 44 0d 80 48 8d 54 24 40 48 8d 4d 80 e8 a2 e0 02 00 48 8b d0 41 b8 01 00 00 00 48 8d 4d d0 e8 e0 05 00 00 48 8d 15 81 f8 0b 00 48 8d 4d d0 e8 a2 46 06 00 90 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 0b 00 00 00 48 8d 15 67 83 09 00 48 8d 4c 24 20 e8 95 5b 01 00 90 48 8d 54 24 20 49 8b cd e8 d7 22 01 00 49 3b c4 74 13 49 83 c9 ff 45 33 c0 49 8b d4 48 8b c8 e8 30 5a 01 00 90 48 83 7c 24 38 08 72 0b 48 8b 4c 24 20 ff 15 54 dd 06 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 07 00 00 00 48 8d 15 bc 82 09 00 48 8d 4c 24 20 e8 32 5b 01 00 90 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 41 b8 07 00 00 00 48 8d 15 91 82 09 00 48 8d 4c 24 40 e8 07 5b 01 00 90 48 8d 54 24 20 48 8d 4d 18 e8 48 22 01 00 48 8b d8 48 8d 54 24 40 48 8b cf e8 38 22 01 00 48 3b c3 74 13 49 83 c9 ff 45 33 c0 48 8b d3 48 8b c8 e8 91 59 01 00 90 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 b5 dc 06 00 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 }
    condition:
            uint16(0) == 0x5a4d and filesize > 300KB and 3 of ($s*) 
}
